Report a vulnerability
Write to [email protected]. Please include:
- what you found, and where (the address, app or page);
- the steps to reproduce it;
- what an attacker could do with it;
- how to reach you, if you would like us to.
How soon we acknowledge a report: To be confirmed
Good-faith research is welcome. Do not access or change other people’s data, do not degrade the service for others, and give us reasonable time to fix a problem before you disclose it. We do not run a paid bug bounty.
What we do
- Every connection to this site and to our apps is encrypted (HTTPS). Live
- Who is calling, and from which app, is signed by our own gateway; a request that carries a forged identity is refused.
- Each organisation’s data, and each person’s, is kept apart, and access is checked on every request.
- Taking someone’s access away never deletes data: it only stops granting access.
- Checking every upload for malware before it becomes a file: proven on our test environment, not yet confirmed on production. In development
- Our production runs on a server we operate, in India. Live
What we have not done yet
- An independent penetration test. Planned
- SOC 2 or ISO/IEC 27001 certification. Not started
- End-to-end encryption of messages. Planned Messages are protected in transit and on our servers, but they are not end-to-end encrypted.
Our domains
anandians.com is our domain: this site, Chat, sign-in, and email from @anandians.com. anandians.org is also ours. dev.magadha.info is our test environment and holds no real data. See the Trust centre.
security.txt
Our security.txt follows RFC 9116 and points here. It expires on 18 April 2027, and we renew it before then.
Security · Version 1.0 · effective · last reviewed · not yet reviewed by counsel. Questions: contact us. Back to the Trust centre.